Complete DNS Setup for Email Sending — The 6 Records You Need

The 6-record full setup#

Every robust email-sending domain needs:

This guide walks each.

Open the sending-domain detail#

In AcelleMail's sidebar, Sending → Sending domains. The list shows every domain you've registered with status chips (Verified / Pending / Failed) and per-auth indicators:

Click into your domain row. The detail page surfaces exactly which DNS records to publish (TXT for SPF, CNAMEs for DKIM, TXT for DMARC) with copy-paste-ready values + current verification state per check:

Record 1: SPF (Sender Policy Framework)#

Tells receiving servers which IPs are authorized to send from your domain.

Publish at the apex domain (yourdomain.com):

Type:  TXT
Name:  yourdomain.com  (root)
Value: v=spf1 include:amazonses.com include:_spf.mailgun.org -all
TTL:   3600

Includes:

• include:amazonses.com if using Amazon SES
• include:_spf.mailgun.org if using Mailgun
• include:sendgrid.net if using SendGrid
• include:spf.example.com for any other vendor (check their docs)

-all (hard fail) tells receivers to REJECT messages from any IP not listed. Use ~all (soft fail) if you're still bringing new vendors online; switch to -all once production-stable.

See SPF record deep dive for the full reference + edge cases.

Record 2: DKIM (DomainKeys Identified Mail)#

Cryptographically signs your outgoing emails so receivers can verify authenticity.

AcelleMail generates the DKIM keypair when you add a sending domain. Per the verify-domain wizard:

Type:  CNAME
Name:  acellemail._domainkey.yourdomain.com
Value: acellemail._domainkey.acellemail.com  (or your AcelleMail-side selector)
TTL:   3600

The exact CNAME target varies per AcelleMail install — the sending-domain detail page shows yours specifically. Most installs use AcelleMail's auto-generated 1024-bit or 2048-bit keys.

See DKIM key rotation playbook for rotation discipline.

Record 3: DMARC (Domain-based Message Authentication, Reporting & Conformance)#

Tells receivers what to do when SPF/DKIM fails for your domain. Plus collects aggregate reports.

Publish at _dmarc subdomain:

Type:  TXT
Name:  _dmarc.yourdomain.com
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-reports@yourdomain.com; fo=1; pct=100
TTL:   3600

Key parameters:

• p= — what to do with failed messages (none = monitor only, quarantine = junk folder, reject = bounce)
• rua= — where to send aggregate reports (typically dmarc-reports@yourdomain.com)
• ruf= — where to send forensic reports (per-failure detail; some receivers don't send these)
• fo= — what failure types to report (1 = SPF or DKIM fail; s = SPF fail; d = DKIM fail; 0 = both fail)
• pct= — what percentage of failed messages to apply the policy to (use 100 for full enforcement; useful for staged rollout)

Staged rollout: start p=none for 30 days. Move to p=quarantine once SPF/DKIM pass rate >99%. Move to p=reject for hardest enforcement.

See DMARC enforcement migration for the staged plan.

Record 4: MX for return-path / bounce subdomain (custom envelope-sender)#

If you use a custom envelope-sender (e.g. bounce.yourdomain.com), AcelleMail needs an MX record so bounces route correctly:

Type:  MX
Name:  bounce.yourdomain.com
Value: feedback.acellemail.com  (or your install's bounce processor)
Priority: 10
TTL: 3600

Without this, bounce messages get rejected by the receiving server's MX lookup. AcelleMail's sending-domain detail page tells you the exact MX target.

For default vendor envelope-senders (e.g. SES's bounces+xxx@amazonses.com), the MX is on AWS's side — no action needed.

Record 5: Custom tracking domain CNAME#

If using a custom click-tracking domain (recommended for brand consistency):

Type:  CNAME
Name:  click.yourdomain.com
Value: track.acellemail.com  (or your install's tracking endpoint)
TTL:   3600

See Custom tracking domain for click URLs for the full setup.

Record 6: BIMI (show your logo in inbox)#

After DMARC enforcement is stable, add BIMI:

Type:  TXT
Name:  default._bimi.yourdomain.com
Value: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem
TTL:   3600

Required: DMARC at p=quarantine or p=reject. See BIMI setup walkthrough.

Verify everything in AcelleMail#

After all 6 records published, the sending-domain detail in AcelleMail shows green chips per auth check:

The auth chips on the sending-server detail#

Open Settings → Sending servers → click your active server. The toolbar shows the live SPF / DKIM / DMARC chip status:

• Green chips on all three = receiving servers can confirm you're authorized to send from this domain.
• Any chip red = receiving servers immediately downgrade reputation. Click Verify domain in the toolbar to walk through the DNS-fix wizard.

Click Verify domain to re-check on demand. AcelleMail's dig-check runs against the receiving-server-side perspective (not your local cache), so propagation issues are detected accurately.

Common UI signals + fixes#

Per-vendor SPF includes reference#

Combine for multi-vendor:

v=spf1 include:amazonses.com include:_spf.mailgun.org include:sendgrid.net -all

DNS lookup limit: 10. Most senders fit comfortably.

# Before:
v=spf1 include:amazonses.com include:_spf.mailgun.org include:sendgrid.net include:spf.mtasv.net -all
# 4 lookups; if any vendor's include has 2-3 sub-includes, you blow the cap

# After (flattened):
v=spf1 ip4:54.240.0.0/18 ip4:13.32.0.0/15 ip4:54.240.36.0/22 ... -all

ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@yourdomain.com header.s=acellemail header.b=...;
       spf=pass smtp.mailfrom=bounce@yourdomain.com;
       dmarc=pass header.from=yourdomain.com
ARC-Seal: i=1; a=rsa-sha256; t=...; ...
ARC-Message-Signature: ...

Customer A:  _dmarc.customerA.com  → Customer's own DMARC policy
Customer B:  _dmarc.customerB.com  → Customer's own DMARC policy

# Daily script: verify all 6 records on all sending domains
domains=$(curl -sH "Authorization: Bearer $TOKEN" \
  "https://acellemail.com/api/v1/admin/sending-domains" | jq -r '.data[].name')

for domain in $domains; do
  spf=$(dig TXT $domain +short | grep -c "v=spf1")
  dkim=$(dig TXT acellemail._domainkey.$domain +short | grep -c "k=rsa")
  dmarc=$(dig TXT _dmarc.$domain +short | grep -c "v=DMARC1")
  bimi=$(dig TXT default._bimi.$domain +short | grep -c "v=BIMI1")

  echo "$domain: SPF=$spf DKIM=$dkim DMARC=$dmarc BIMI=$bimi"
done

Related articles#

• How to set up SPF, DKIM, and DMARC records
• SPF record deep dive
• DMARC enforcement migration
• Return-path and envelope-sender explained
• Custom tracking domain for click URLs
• BIMI setup — show your logo in Gmail
• DNS propagation explained